Hostinger MCP server

hostinger-api-mcp

Model Context Protocol (MCP) server for Hostinger API.

Quick start: Hosted remote server

If you don't want to install or run anything locally, connect directly to Hostinger's hosted MCP server:

https://mcp.hostinger.com

Claude Code

claude mcp add --transport http hostinger https://mcp.hostinger.com

This opens a browser window to authorize via OAuth. Once approved, the operations below are reachable through execute in your session.

Codex

codex mcp add hostinger --url https://mcp.hostinger.com
codex mcp login hostinger

login opens the same OAuth flow in your browser.

Other MCP-compatible clients

Add https://mcp.hostinger.com as a remote Streamable HTTP MCP server in your client's configuration and complete the OAuth prompt when it appears. Refer to your client's docs for how it exposes "add remote MCP server" / "custom connector" settings.

Prerequisites

• Node.js version 24 or higher

If you don't have Node.js installed, you can download it from the official website. Alternatively, you can use a package manager like Homebrew (for macOS) or Chocolatey (for Windows) to install Node.js.

We recommend using NVM (Node Version Manager) to install and manage installed Node.js versions. After installing NVM, you can install Node.js with the following command:

nvm install v24
nvm use v24

Installation

To install the MCP server, run one of the following command, depending on your package manager:

# Install globally from npm
npm install -g @hostinger/mcp

# Or with yarn
yarn global add @hostinger/mcp

# Or with pnpm
pnpm add -g @hostinger/mcp

Update

To update the MCP server to the latest version, use one of the following commands, depending on your package manager:

# Update globally from npm
npm update -g @hostinger/mcp

# Or with yarn
yarn global upgrade @hostinger/mcp

# Or with pnpm
pnpm update -g @hostinger/mcp

Binaries

This package installs the following MCP server commands:

• hostinger-api-mcp — unified server over every operation (409 total)
• hostinger-agency-hosting-mcp — 43 operations for agency-hosting
• hostinger-agent-readiness-mcp — 4 operations for agent-readiness
• hostinger-billing-mcp — 10 operations for billing
• hostinger-dns-mcp — 9 operations for dns
• hostinger-domains-mcp — 43 operations for domains
• hostinger-ecommerce-mcp — 30 operations for ecommerce
• hostinger-gpu-mcp — 5 operations for gpu
• hostinger-horizons-mcp — 7 operations for horizons
• hostinger-hosting-mcp — 54 operations for hosting
• hostinger-mail-mcp — 39 operations for mail
• hostinger-reach-mcp — 71 operations for reach
• hostinger-vps-mcp — 68 operations for vps
• hostinger-wordpress-mcp — 41 operations for wordpress

Every binary exposes the same three tools; a scoped binary only searches and executes its own group's operations. hostinger-api-mcp remains the backwards-compatible default.

Configuration

The following environment variables can be configured when running the server:

• DEBUG: Enable debug logging (true/false) (default: false)
• HOSTINGER_API_TOKEN: Your API token, which will be sent in the Authorization header. When set, OAuth is bypassed entirely.
• API_TOKEN: Deprecated alias for HOSTINGER_API_TOKEN. Will be removed in a future version — prefer HOSTINGER_API_TOKEN.
• OAUTH_ISSUER: OAuth server base URL (default: https://auth.hostinger.com). Only used when HOSTINGER_API_TOKEN is not set.

Authentication

The server supports two authentication methods:

API Token (recommended for CI/scripts)

Set HOSTINGER_API_TOKEN in the environment (the MCP client's env block). When present it always takes precedence — no OAuth code runs.

OAuth 2.0 with PKCE (interactive sign-in)

When HOSTINGER_API_TOKEN is not set and the server runs in stdio mode, OAuth 2.0 with PKCE is used automatically on the first authenticated tool call:

1. A dynamic OAuth client is registered with the issuer (RFC 7591) — once per machine.
2. A browser window opens to the authorization page.
3. After sign-in, the server captures the redirect on a local ephemeral port, exchanges the code for tokens, and stores them.
4. Subsequent calls reuse the stored access token; expired tokens are refreshed automatically. If a refresh token is revoked, the browser flow is re-launched.

Credentials are stored at:

• macOS / Linux: ~/.config/hostinger-mcp/credentials.json (mode 0600)
• Windows: %APPDATA%\hostinger-mcp\credentials.json

Credentials are shared across all Hostinger MCP binaries (hostinger-api-mcp, hostinger-vps-mcp, etc.).

Manual commands:

# Run the OAuth sign-in flow immediately (don't wait for the first tool call)
hostinger-api-mcp --login

# Revoke stored credentials
hostinger-api-mcp --logout

HTTP transport note: OAuth sign-in is not supported in --http mode. Set HOSTINGER_API_TOKEN before using --http.

Usage

JSON configuration for Claude, Cursor, etc.

Register Node and the server script by absolute path, never npx or a bare node/hostinger-api-mcp: tools start the server in your project, where npx puts the project's node_modules/.bin first on PATH, a version manager (asdf, mise) runs whatever Node the project's .tool-versions names, and Windows looks a bare name up in the project folder first. Any of these lets a cloned repository run its own code with your Hostinger credentials. After the global install, node -p process.execPath prints the Node path and npm root -g the folder that holds @hostinger/mcp. Run both from your home folder.

{
    "mcpServers": {
        "hostinger-api": {
            "command": "/absolute/path/to/node",
            "args": ["/absolute/path/to/global/node_modules/@hostinger/mcp/src/servers/all.js"],
            "env": {
                "DEBUG": "false",
                "HOSTINGER_API_TOKEN": "YOUR API TOKEN"
            }
        }
    }
}

Transport Options

The MCP server supports two transport modes:

Standard I/O Transport

The server can use standard input / output (stdio) transport (default). This provides local streaming:

Streamable HTTP Transport

The server can use HTTP streaming transport. This provides bidirectional streaming over HTTP:

# Default HTTP transport on localhost:8100
hostinger-api-mcp --http

# Specify custom host and port
hostinger-api-mcp --http --host 0.0.0.0 --port 8150

Command Line Options

Options:
  --http           Use HTTP streaming transport (requires HOSTINGER_API_TOKEN env var)
  --stdio          Use Server-Sent Events transport (default)
  --host {host}    Hostname or IP address to listen on (default: 127.0.0.1)
  --port {port}    Port to bind to (default: 8100)
  --login          Run OAuth sign-in flow and exit
  --logout         Revoke stored OAuth credentials and exit
  --help           Show help message

Using as an MCP Tool Provider

This server implements the Model Context Protocol (MCP) and can be used with any MCP-compatible consumer.

Example of connecting to this server using HTTP streaming transport:

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

// Create HTTP transport
const transport = new StreamableHTTPClientTransport({
  url: "http://localhost:8100/",
  headers: {
    "Authorization": `Bearer ${process.env.HOSTINGER_API_TOKEN}`
  }
});

// Connect to the MCP server
const client = new Client({
  name: "my-client",
  version: "1.0.0"
}, {
  capabilities: {}
});

await client.connect(transport);

// List available tools
const { tools } = await client.listTools();
console.log("Available tools:", tools);

// Execute an operation
const result = await client.callTool({
  name: "execute",
  arguments: { operation: "billing_catalog_list", params: { category: "DOMAIN" } }
});
console.log("Tool result:", result);

Tools

Every server exposes three tools:

• search — find operations by keyword; returns each match with its inputSchema.
• execute — run one operation: { "operation": "<name>", "params": { ... } }.
• multi-execute — run up to 20 operations in order, stopping at the first failure. A params value that is exactly "$steps.<i>.<path>" is replaced by that value from an earlier step's result.

Operations

The operations search offers, by binary:

Operations that newer tools replace are hidden from search, and not documented, in every binary that also offers the replacing tool. Some keep working through execute until they are removed. Others only run inside the tool that replaced them: execute refuses them and names that tool.

hostinger-agency-hosting-mcp

changelog_list-entries

What's new and what's coming at Hostinger: list entries of the public Hostinger changelog (release notes, product updates, recent changes, new features and improvements) and of the public roadmap (upcoming features not released yet). Released entries come newest first; upcoming items come soonest expected release first. Reads released changelog entries by default; pick upcoming for the roadmap or all for both. Filter by product or date. Each entry has its title, summary, product, URL, status (released or upcoming), and plan when the entry states one; released entries have their date, upcoming items their expected release date when set. Needs no API token.

• Method: custom
• Path: custom

agency-hosting_deploy-node-static-website

Deploy a node-static Agency Plan (h5g) website from an archive file. WARNING: this overwrites the website's existing contents and cannot be undone — always confirm with the user before proceeding. Use this for Agency Plan websites of type node-static (a Node.js-built static site that requires a build step or a plain simple static site). The tool resolves the website from its domain, uploads the archive to the website's file browser over TUS, and triggers the build-assets process which builds the site and deploys the result to public_html. This operation is synchronous: the build and deployment complete before the tool returns, so the website is live as soon as the tool finishes successfully — there is no separate asynchronous build to wait for or poll. Upload credentials are generated and used internally — do not call a separate upload-url endpoint or upload the archive yourself, this tool does it end-to-end. For plain PHP applications that should be extracted as-is, use agency-hosting_deploy-php-application instead. The website UID is automatically resolved from the domain.

• Method: custom
• Path: custom

agency-hosting_deploy-php-application

Deploy a PHP (or other non-build) Agency Plan (h5g) website from an archive file. WARNING: this overwrites the website's existing contents and cannot be undone — always confirm with the user before proceeding. Use this for Agency Plan websites where the archive contents should be extracted and served as-is with no build step (e.g., PHP applications). The tool resolves the website from its domain, uploads the archive to the website's file browser over TUS, and triggers the import-archive process which overwrites the website contents with the archive contents. This operation is synchronous: the archive is extracted and deployed before the tool returns, so the website is live as soon as the tool finishes successfully — there is no separate asynchronous build to wait for or poll. Upload credentials are generated and used internally — do not call a separate upload-url endpoint or upload the archive yourself, this tool does it end-to-end. For node-static websites that require a build step, use agency-hosting_deploy-node-static-website instead. The website UID is automatically resolved from the domain.

• Method: custom
• Path: custom

agency-hosting_datacenters_list

Lists the datacenters available for provisioning a new website on the given Agency Plan hosting order.

Each datacenter includes a pinger_url you can ping from the client to measure round-trip latency; comparing the results across datacenters lets you pick the nearest one (lowest ping) before choosing its code as the datacenter_code when creating a website setup.

• Method: GET
• Path: /api/agency-hosting/v1/orders/{order_id}/datacenters

agency-hosting_domains_change-website

Changes the primary domain for an Agency Plan website.

Provide the current domain in the path and the new domain in the request body. Set domain to null to revert to the temporary domain.

• Method: PUT
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains/{from_domain}

agency-hosting_domains_link-to-website

Links a domain to the specified Agency Plan website so it can serve traffic for that domain.

• Method: POST
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains

agency-hosting_domains_list

Returns a paginated list of domains associated with Agency Plan websites accessible to the authenticated client.

Use the website_uuids filter to narrow results to specific websites.

• Method: GET
• Path: /api/agency-hosting/v1/domains

agency-hosting_domains_unlink-from-website

Unlinks a domain from the specified Agency Plan website.

The website stops serving traffic on this domain immediately.

Website files and database are preserved, and any other linked domains remain accessible.

If this is the only domain on the website, unlinking leaves the website without an accessible domain.

• Method: DELETE
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains/{domain}

agency-hosting_files_generate-upload-url

Generate a file browser upload URL with authentication credentials for uploading files to an Agency Plan website's file storage.

Returns url, auth_key and rest_auth_key. Use these to upload a file to the website's file storage via the TUS resumable upload protocol (TUS 1.0.0). Send X-Auth: {auth_key} and X-Auth-Rest: {rest_auth_key} headers on every request below.

1. Create the upload: POST to {url}/{relative_file_path}?override=true with headers upload-length: {file size in bytes} and upload-offset: 0. Expect 201 Created.
2. Upload the file: send the file bytes to the same location (any TUS 1.0.0 client, or PATCH requests with an upload-offset header tracking progress) until complete.

relative_file_path is the destination path inside the website's file storage, e.g. app.zip.

Instead of a TUS client, plain curl also works:

FILE=app.zip
SIZE=$(stat -f%z "$FILE")   # stat -c%s on Linux

curl -i -X POST "{url}/${FILE}?override=true" \
  -H "X-Auth: {auth_key}" \
  -H "X-Auth-Rest: {rest_auth_key}" \
  -H "Tus-Resumable: 1.0.0" \
  -H "Upload-Length: ${SIZE}" \
  -H "Upload-Offset: 0"
# -> 201 Created

curl -i -X PATCH "{url}/${FILE}?override=true" \
  -H "X-Auth: {auth_key}" \
  -H "X-Auth-Rest: {rest_auth_key}" \
  -H "Tus-Resumable: 1.0.0" \
  -H "Content-Type: application/offset+octet-stream" \
  -H "Upload-Offset: 0" \
  --data-binary "@${FILE}"
# -> 204 No Content, Upload-Offset response header equals SIZE when done

• Method: POST
• Path: /api/agency-hosting/v1/websites/{website_uid}/files/upload-urls

agency-hosting_files_import-website-from-archive

Imports an Agency Plan website from an already-uploaded archive.

Upload the archive to the website's root directory via file browser first, then provide its filename in this request. Website contents are overwritten by the archive contents. Supported archive types: .zip, .tar, .tar.gz, .tgz.

• Method: POST
• Path: /api/agency-hosting/v1/websites/{website_uid}/files/import-archive

agency-hosting_metrics_list-plan-order-disk-usage

Returns aggregated disk and inode usage for the Agency Plan order over the selected time frame, plus the plan quotas. Figures cover the whole order account. Values may be up to one hour stale. CPU, memory, and process usage are on the resource-usage-metrics endpoint.

• Method: GET
• Path: /api/agency-hosting/v1/orders/{order_id}/disk-usage-metrics

agency-hosting_orders_list

Returns a paginated list of Agency Plan orders accessible to the authenticated client.

• Method: GET
• Path: /api/agency-hosting/v1/orders

agency-hosting_metrics_list-order-resource-usage

Returns aggregated CPU, memory, and process usage for the Agency Plan order over the selected time frame, plus the plan quotas and a per-website breakdown. Each website is identified by uid. Suspended and deleted websites are excluded from both the order totals and the per-website breakdown. Values may be up to one hour stale. Disk and inode usage are on the disk-usage-metrics endpoint.

• Method: GET
• Path: /api/agency-hosting/v1/orders/{order_id}/resource-usage-metrics

agency-hosting_php_list-extensions-for-website

Lists every PHP extension available to an Agency Plan website and whether it is currently enabled.

• Method: GET
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/extensions

agency-hosting_php_replace-website-extensions

Replaces the set of PHP extensions enabled on an Agency Plan website with the ones provided. Any toggleable extension not in the request is disabled, so call the extensions endpoint first and send the full desired set. Extensions compiled into PHP, reported with the "built-in" state, are always active and are unaffected.

• Method: PUT
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/extensions

agency-hosting_php_list-options-for-website

Lists the php.ini directives that can be configured for an Agency Plan website, each with its default, the value currently in effect, and the values it accepts.

• Method: GET
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/options

agency-hosting_php_replace-website-options

Replaces the custom php.ini values on an Agency Plan website with the ones provided. Any option not in the request is reset to its default, so call the options endpoint first and send the full desired set. Sending an empty array resets every option to its default.

• Method: PUT
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/options

agency-hosting_php_list-versions-for-order

Lists the PHP versions available to websites created under an Agency Plan order, determined by the server the order is hosted on. Use this before creating a website; for a website that already exists, call the website-scoped versions endpoint instead.

• Method: GET
• Path: /api/agency-hosting/v1/orders/{order_id}/websites/php-settings/versions

agency-hosting_php_list-versions-for-website

Lists the PHP versions an Agency Plan website can be switched to. The version the website is currently running is returned as settings.php.version by the website details endpoint.

• Method: GET
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/versions

agency-hosting_php_update-website-version

Switches an Agency Plan website to a different PHP version. Call the available versions endpoint first to see which versions can be selected. The website restarts on the new version, so requests served during the switch may fail and code that is incompatible with the target version will break.

• Method: PATCH
• Path: /api/agency-hosting/v1/websites/{website_uid}/php-settings/version

agency-hosting_website-setups_create

Provisions a new website on one of your Agency Plan hosting orders.

Choose the datacenter, stack (flavor), and PHP version for the site. Optionally attach your own domain — omit it, set it to null, or leave it unavailable and a free *.hostingersite.com subdomain is generated instead — and/or install WordPress by supplying the wordpress details (admin account, site title, and language).

Common setups:

• Plain PHP site: flavor set to php-fpm, with settings.php.version; omit wordpress and type.
• WordPress site: flavor set to the desired WordPress version (e.g. wp-7.0), plus the wordpress block (admin account, title, language).
• Static/Node.js frontend app: flavor set to php-fpm and type set to node-static.

Provisioning runs in the background, so the response returns immediately with a setup UUID that identifies the job. The new website becomes reachable once provisioning finishes.

• Method: POST
• Path: /api/agency-hosting/v1/orders/{order_id}/websites/setups

agency-hosting_website-setups_status

Returns the current status of an Agency Plan website setup started via the setups endpoint.

Poll this endpoint using the setup_uuid returned from the provisioning request until status becomes completed, at which point website_uid identifies the new website.

• Method: GET
• Path: /api/agency-hosting/v1/orders/{order_id}/websites/setups/{setup_uuid}

agency-hosting_ssl_reinstall-website

Replaces the Let's Encrypt certificate of the domain: the current platform certificate, when one is recorded, is revoked and removed, then a new setup starts in the background. Returns at once; Get website SSL status reports installing while it runs, then active or failed.

Returns 422 for free subdomains, when a certificate process is recorded for the domain (a failed setup counts until it is cleaned up), or when the domain hit its limit of three setups per seven days. Returns 429 when the same domain was requested less than a minute ago, and 403 when the website is suspended or locked, and 404 when the website or the domain does not exist.

• Method: POST
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains/{domain}/ssl/reinstall

agency-hosting_ssl_install-website

Starts a Let's Encrypt certificate setup for the domain and returns at once; the setup runs in the background. Get website SSL status reports installing while it runs, then active or failed; the ssl_setup entry of List website processes shows the same progress.

Returns 422 when the domain already has a platform certificate that is not expired, when a certificate process is recorded for the domain (a failed setup counts until it is cleaned up), or when the domain hit its limit of three setups per seven days. Returns 429 when the same domain was requested less than a minute ago, 403 when the website is suspended or locked, and 404 when the website or the domain does not exist.

• Method: POST
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains/{domain}/ssl/setup

agency-hosting_ssl_website-status

Returns the SSL state of one domain of an Agency Plan website: the certificate status, whether the certificate was uploaded by the customer, and when it stops being valid.

installing means a certificate setup is running or retrying; the ssl_setup entry of List website processes shows the same progress. active means a valid certificate is in place: uploaded by the customer, issued by the platform, or a lifetime certificate bought for the domain. failed means the last setup gave up and no valid certificate is in place. expired means the certificate has run out. not_installed means the domain has no certificate and no setup process. Returns 404 when the website or the domain does not exist.

• Method: GET
• Path: /api/agency-hosting/v1/websites/{website_uid}/domains/{domain}/ssl/status